AI Code Review Catches Nulls and XSS Instantly — and Still Can't Tell You a Discount Makes Prices Negative
AI-generated PRs are flooding teams — GitLab reports 85% of developers say the bottleneck has already shifted from writing code to reviewing it. Knowing exactly which review tasks AI can absorb (and which it will silently botch) is the difference between a faster pipeline and a pipeline that ships negative prices and broken permission guards.
Running Claude Code against a 30,000-line React frontend revealed a sharp split in capability. AI caught unhandled nulls, performance anti-patterns, XSS vectors, naming inconsistencies, and repeated code patterns across 14 components — checks human reviewers routinely skip. On the other side, it missed that a price calculation could go negative when a discount exceeds the original price, recommended three individually correct optimizations that would combine to trash rendering performance, and suggested replacing a readable if-else chain with a lookup map that would confuse the next developer adding a role.
The experiment produced a practical division of labor: AI handles correctness checks (nulls, perf, security, style, duplication) while humans own business logic, architecture, UX impact, and cross-module side effects. The author's revised workflow runs an AI scan in five minutes, then spends ten minutes on the questions AI cannot answer — whether the requirement is understood, whether the solution is the simplest, and whether users will hate it.
One hard rule emerged: code AI marks clean is not actually clean. It only means nothing is wrong within the model's visible range. Business rules, architectural coherence, and user experience remain exclusively human territory.
The asymmetry is striking: AI is strongest at the tedious, mechanical checks humans hate doing and weakest at the judgement calls that define senior engineering — business rules, architectural coherence, and user empathy. This makes it a force multiplier for senior devs and a liability for juniors who might trust its clean bill of health.
The finding that AI is good at catching security flaws in AI-generated code — because it knows its own failure modes — suggests a self-auditing loop could become standard: generate, then have the same model review for the vulnerability patterns it tends to produce.
AI's inability to reason about cross-module side effects is not a temporary context-window limitation; it's a fundamental architectural blindness. Even with infinite context, today's models lack a causal model of how data flows through a system over time, which is what makes a permission-guard cache-staleness bug invisible to them.
The 'correct but harmful' refactoring problem — replacing explicit if-else with a lookup map — is a reminder that code is read and modified by humans who follow patterns. Optimizing for elegance can destroy the discoverability that makes a codebase maintainable by a rotating cast of developers.